Database
Critical WordPress vulnerabilities (page 58)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Payment Bypass
Visma Pay for Woocommerce
<1.2.2Update to 1.2.2
- Medium5.38.0.5 - Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
7.9.5 – 8.0.5Update to 8.0.6
- Medium5.39.3.0 - Unauthenticated Insecure Direct Object Reference
NEX-Forms – Ultimate Forms Plugin for WordPress
9.2.1 – 9.3.0Update to 9.3.1
- High7.5Unauthenticated Arbitrary File Read
Contact Form 7 Signature Addon
≤4.2.2No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
Ukr-To-Lat
≤1.3.5No patch available
- High7.3Unauthenticated Snippet Safe Mode Bypass
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
<2.4.0Update to 2.4.0
- Medium5.3Missing Authorization
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Email
Responsive Blocks – Page Builder for Blocks & Patterns
<2.3.0Update to 2.3.0
- High7.3Unauthenticated Arbitrary Order Status Manipulation
Paymentfor Gateway for WooCommerce
<1.0.6Update to 1.0.6
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium6.5Authenticated (Contributor+) SQL Injection
BSK PDF Manager
<3.8.2Update to 3.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Forms
<3.0.2Update to 3.0.2
- Medium6.42.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Pricing Table – Block – Show Product or Service Pricing in Table Format
1.0.7 – 2.1.4Update to 2.1.5
- Medium5.32.0.2.1 - Unauthenticated Payment Bypass on Paid Forms
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.10.0.1 – 2.0.2.1Update to 2.0.2.2
- High8.8Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
Email Customizer for WooCommerce (Pro)
≤3.9.5Update to 3.9.6
- Critical9.8Unauthenticated Account Takeover
OTP Login & Register Woocommerce
≤2.7.2Update to 2.7.3
- Medium4.3Cross-Site Request Forgery
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.2Update to 10.31.3
- Medium6.5Authenticated (Contributor+) SQL Injection
CP Multi View Events Calendar
≤1.4.41Update to 1.4.42
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
<3.7.4Update to 3.7.4
- High8.1Unauthenticated Local File Inclusion
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
<2.17.2Update to 2.17.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.16Update to 3.6.16
- High7.2Unauthenticated Stored Cross-Site Scripting
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19
- High7.3Missing Authorization to Unauthenticated Settings Modification
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Booking System – Booking Calendar
<2.1.0.1Update to 2.1.0.1
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
<6.1.1Update to 6.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gutenverse Form – Contact Form Builder, Block Form & Booking Form
<3.0.11Update to 3.0.11
- Medium5.3Unauthenticated Insecure Direct Object Reference
CodeAtoZ B2B Suite for WooCommerce
<1.6.1Update to 1.6.1
- Medium6.44.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
4.10.1 – 4.10.5Update to 4.10.6
- Medium5.3Missing Authorization to Unauthenticated SEO Data Deletion
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.280Update to 1.0.280